Which versions of Juggle are affected by CVE-2026-67208?

Somta Juggle versions 1.6.0 and earlier contain a critical remote code execution vulnerability exploitable by unauthenticated attackers to achieve root-level access to affected systems through an…

Is there a public PoC exploit available for CVE-2026-67208?

Yes, a public proof-of-concept exploit is available for CVE-2026-67208. Prioritise patching immediately. EPSS: 1.1%.

How to fix or mitigate CVE-2026-67208?

Within 24 hours: audit all Somta Juggle deployments to identify internet-facing or network-accessible instances, and implement immediate firewall rules to restrict access to /h2-console. Within 7 days: disable the H2 database web console if operationally feasible, change all default database credentials, deploy WAF rules blocking /h2-console requests, and establish enhanced logging for database and OS command activity. Within 30 days: no vendor-released patch is currently available-evaluate alternative products or implement persistent network segmentation; immediately apply any security patch when released by the vendor.

Juggle CVE-2026-67208

Q: What is the CVSS score of CVE-2026-67208?

CVE-2026-67208 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

EUVD-2026-51278 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-30 VulnCheck

GHSA-8rhq-39vx-cjqx

Authentication Bypass RCE Docker Juggle

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated access to a default-credential H2 console (PR:N, AC:L, AV:N) yields full OS command execution, so C/I/A all High; scope unchanged as impact is on the same vulnerable host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:51 vuln.today

CVE Published

Jul 30, 2026 - 19:17 cve.org

CRITICAL 9.3

DescriptionCVE.org

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.

Articles & Coverage 2

News 3 New Docker Vulnerabilities - 1 Critical, 2 High Severity Jul 31, 2026 News Critical RCE in Docker via Exposed H2 Console Default Credentials - CVE-2026-67208 Jul 30, 2026

AnalysisAI

Remote code execution in Somta Juggle through version 1.6.0 lets unauthenticated network attackers run arbitrary OS commands by reaching the bundled H2 database web console, which ships exposed at /h2-console with default credentials. Because the stock Docker image runs as root, successful exploitation via the classic H2 CREATE ALIAS Runtime.exec() technique yields root-level code execution on the host container. No public exploit identified at time of analysis, though the VulnCheck advisory provides a detailed exploitation path.

Technical ContextAI

Juggle is an API gateway/service orchestration application (vendor 'somta') distributed as a Docker image. The vulnerability stems from an embedded H2 database whose web management console (/h2-console) is left network-accessible and protected only by shipped default credentials. H2's console permits arbitrary JDBC connections and SQL, and its CREATE ALIAS feature can bind a SQL function to arbitrary Java, including java.lang.Runtime.exec(), converting database access into OS command execution. This maps to CWE-306 (Missing Authentication for a Critical Function): a security-critical administrative interface is reachable without any effective authentication barrier because the credentials are static and publicly known. The affected product per CPE is cpe:2.3:a:somta:juggle:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch identified at time of analysis; the only references are the VulnCheck advisory (https://www.vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-console) and GitHub issue #86 (https://github.com/somta/Juggle/issues/86), neither of which is a tagged release. As compensating controls, disable or remove the H2 web console entirely (in Spring configuration set spring.h2.console.enabled=false), which stops the attack but removes browser-based DB management; if the console is operationally required, restrict it to localhost/loopback and place it behind network ACLs or a firewall so /h2-console is unreachable from untrusted networks, and block external access to the console port. Change the default H2 database credentials to strong unique values to defeat the default-credential authentication, and run the container as a non-root user to reduce blast radius (though this does not prevent command execution, only root-level impact). Track the upstream issue for an official fixed release before relying on an in-place upgrade.